IBX-1286: Tables template XSS vulnerability - default |raw (#68)

ezsystems · Oct 25, 2021 · bf729e1 · bf729e1
1 parent e24b84d
commit bf729e1
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 11 deletions.
diff --git a/src/bundle/Resources/views/themes/admin/matrix_fieldtype/content_edit_form_fields.html.twig b/src/bundle/Resources/views/themes/admin/matrix_fieldtype/content_edit_form_fields.html.twig
@@ -17,7 +17,7 @@
     {% set head_cols = head_cols|merge([{}]) %}
 
     {% embed '@ezdesign/ui/component/table/table.html.twig' with {
-        head_cols: head_cols,
+        head_cols,
         class: 'ibexa-table--not-striped',
         table_body_attr: {
             'data-minimum-rows': minimum_rows,
@@ -81,7 +81,7 @@
     {% set body_row_cols = body_row_cols|merge([{ content: col_actions }]) %}
 
     {% include '@ezdesign/ui/component/table/table_body_row.html.twig' with {
-        body_row_cols: body_row_cols,
+        body_row_cols,
         class: 'ibexa-table__matrix-entry',
     } %}
 {% endblock %}

diff --git a/src/bundle/Resources/views/themes/admin/matrix_fieldtype/content_fields.html.twig b/src/bundle/Resources/views/themes/admin/matrix_fieldtype/content_fields.html.twig
@@ -22,7 +22,7 @@
 
     {% include '@ezdesign/ui/component/table/table.html.twig' with {
         headline: 'field.columns'|trans|desc('Columns'),
-        head_cols: head_cols,
-        body_rows: body_rows,
+        head_cols,
+        body_rows,
     } %}
 {% endblock %}
diff --git a/src/bundle/Resources/views/themes/admin/matrix_fieldtype/field_types.html.twig b/src/bundle/Resources/views/themes/admin/matrix_fieldtype/field_types.html.twig
@@ -17,9 +17,9 @@
 
             {% include '@ezdesign/ui/component/table/table_body_row.html.twig' with {
                 body_row_cols: [
-                    { has_checkbox: true, content: col_checkbox },
-                    { content: form_widget(form.columns.vars.prototype.name) },
-                    { content: form_widget(form.columns.vars.prototype.identifier) },
+                    { has_checkbox: true, content: col_checkbox, raw: true },
+                    { content: form_widget(form.columns.vars.prototype.name), raw: true },
+                    { content: form_widget(form.columns.vars.prototype.identifier), raw: true },
                 ],
                 class: 'ez-matrix-settings__column',
             } %}
@@ -34,9 +34,9 @@
 
             {% set body_rows = body_rows|merge([{
                 cols: [
-                    { has_checkbox: true, content: col_checkbox },
-                    { content: form_widget(column.name) },
-                    { content: form_widget(column.identifier) },
+                    { has_checkbox: true, content: col_checkbox, raw: true },
+                    { content: form_widget(column.name), raw: true },
+                    { content: form_widget(column.identifier), raw: true },
                 ],
                 class: 'ez-matrix-settings__column',
             }]) %}
@@ -49,7 +49,7 @@
                 { content: 'field.column.name'|trans|desc('Name') },
                 { content: 'field.column.identifier'|trans|desc('Identifier') },
             ],
-            body_rows: body_rows,
+            body_rows,
             table_body_attr: {
                 'data-next-index': form.columns.children|length ? max(form.columns.children|keys) + 1 : 0,
             }